Hardware Hacking the IOMEGA StorCenter ix2-200

Introduction

The StorCenter ix2-200 is a RAID network drive supplied by iomega. I have used the 2TB version for about two years now to keep secure (backed up) copies of my precious data. Any data I write to the device is mirrored on its paired 2TB drive inside the unit, so one drive can fail and I’ll still keep my data.

Recently I’ve had cause for complaint with this unit’s default network setup routine. When you switch the device on it goes through a boot-routine which involves setting up the network address and subnet. If possible it does this via dhcp so if you’ve got it connected to your router it’ll be assigned an appropriate IP and will be instantly visible on the network.
The problems start when, for whatever reason, the device is not able to obtain network settings via dhcp. In that case it assigns itself an address in the range 169.254.x.x with subnet 255.255.0.0. In that case the network drive could end up with one of 65536 possible IP addresses in that range. How is one supposed to know what IP address it’s assigned itself?

Hardware Hacking

Location of JP1 on ix2-200

I had two choices. Set my computer to scan all of the 65536 possible IP addresses until it finds an active one. Or, take the unit apart and see what hardware hacking can be done. The former is probably quicker, but the latter is more fun. Hence, this hardware hacking blog was born.

With the unit apart, I found a conspicuous looking pin header called JP1. A few pokes around with my ‘scope revealed what looked like microprocessor level (3.3V) RS232 comms on one of the pins.

Completing the hack…

RS232 data on pin (2)

The next task was to try and see if I could view these signals on a PC. The main problem here is the fact that the data output is 3.3V logic levels (basically it’s the raw output from a microprocessor) and the RS232 input to a PC is +/-12V standard RS232 logic levels. It’s easily solved though, you just need to get yourself an RS232 level-shifter chip such as a MAX3232 and rig-up a circuit as per my schematic shown below, and then connect it to JP1 (as shown on the schematic) according to the pinout in the photo.

I only had an SMT version of the MAX3232 part in my junk bin so I soldered it onto some proto-board with the 0.1uF capacitors tacked on top and then I wired it up to JP1 as shown in the photo below.

My hacked on level shifter IC to interface with the PC

Viewing the data on the PC.

In order to view the data on a PC you simply need to put everything back together, connect the ends of your cables to a DB9 connector as shown in the schematic, and then connect the DB9 connector to your PC’s serial port via a standard 9-way serial cable. Then fire up a terminal (I recommend PuTTY) and enter the following settings:

PuTTY Terminal Settings

Once you’ve entered in the settings, select connect, and power on the NAS. If all goes well some boot-time debug data should start spitting out on the terminal. Something like that shown below:

Debug data coming through over the terminal

After 2-3 minutes you should be presented with a login prompt. If you want to gain root access to the NAS over your PC terminal simply log in with the following credentials:

USER: root
PASS: soho

Gaining root access via the terminal

Sweet!

That’s it – you’re in with root privileges. You can now enter the standard Linux commands and change whatever you wish. My main reason for going to all this trouble (apart from enjoying hardware hacking) was to find out the boot-time network settings it was assigning itself. Once I knew those I was able to gain access via the standard PC based web interface and change the settings to suit my home network.

I hope you enjoyed! Here is a quick video of the entire boot process and logging in:

3 Replies to “Hardware Hacking the IOMEGA StorCenter ix2-200”

Hi Brian, excellent article, today I updated the firmware on my ix200, and it processed the update fine, however when visiting 192.168.1.2 (the ip of my ix200) it automaticly comes up with http://192.168.1.2/restart.html?pg=/index.html

It states the “device software restart is in progress”, followed by “the device is starting up”.

It has hanged it, no matter how many restarts, refreshing whatever, it goes no further.

Hey Brian, I was just reading your post about losing access to the ix2 web-gui. Were you ever able to restore access to the web gui? I am able to browse all contents of the drive so it would appear that all content is fine….just no web-gui access. Any ideas?

I have experienced two symptoms related to the web-gui with the ix2-200. These were:

1.
When I tried to browse to the web-gui via the ix2 ip address I received an unable to connect message and no web-gui appeared. In this case the problem was that the ix2 was on a different subnet to my network adapter. The ix2 had 255.255.0.0 and my network adapter was set to 255.255.255.0. For some reason this gave me the symptom above, even though I was still able to browse the network shares themselves without problem.

2.
In another scenario, I was able to reach the ix2 web page just fine, and the GUI frontpage was displayed, but there were no icons. In this case the problem was that the ix2 wasn’t set to show me any information. The solution here was to log in to the NAS (via the little key icon in the top right) and then visit http://ix2-ip/manage.html. Obviously change the ix2-ip to suit the address of your NAS. You should then get the GUI. Somewhere in the settings I was able to tell it what to show me on the front page and then this problem went away.